Looks like you made the same mistake I did (which you caught), namely, providing a URI in Response which is likely a copy from `grantPermission`.